🧾"Thanks for Your Purchase": The Fake Receipt Is Back for the Holidays

Between Thanksgiving and New Year's, the average American inbox fills with receipts: order confirmations, shipping notices, subscription renewals, "your payment was successful." Most of them are real. Scammers have noticed that December is the one month when a receipt for something you don't remember buying doesn't feel impossible. It feels like Tuesday.

The fake receipt is one of the oldest email scams there is, and this fall it has come back dressed for the season. In Scamwise data, submissions of fake order confirmations and invoices rose by nearly half in October, and they share a shape: a polished "Thanks for your purchase!" email, an order number, a date, a card ending in four digits, a line item you'd never buy (a $351 two-year antivirus plan, a coffee maker paid through PayPal, a ten-seat Google Workspace subscription, an Amazon order you can't place) and, somewhere near the bottom, a phone number "to cancel within 24 hours" or "if you did not authorize this transaction."

The email is the bait; the phone number is the hook. The person who answers is "billing support," and the refund they offer requires either your card details to "reverse the charge" or, more often, remote access to your computer to "process" it. That is how a fake $351 charge becomes a real drained bank account. It is the same script that powered the McAfee and Geek Squad renewal-invoice scams of the last two years, now wearing whatever brand sells best in December.

The important trend here is that the fake receipt has become the email counterpart of the fake fraud alert. The fraud-alert robocall says "a purchase was placed on your account, press one"; the fake receipt says "thanks for your order, call us if this wasn't you." Same lure, different channel, and the email version is growing as the robocall version cools. It is also a big part of why Microsoft, Amazon and PayPal all sit in the top four of our Brand Imposter Leaderboard this winter: account alerts, order confirmations and invoices are the three costumes the same scam wears.

As we watch this trend, we're keeping an eye on receipts that borrow a retailer's real transactional template (the fake Amazon confirmation is now close to pixel-perfect) and on the post-holiday variant: "your return has been processed" and "your refund is pending" emails that will arrive in January, when returns are what everyone is doing.